Monitoring systems are designed to identify anomalous features in data received from multiple sources and to characterize and report such anomalies as events occurring on the system being monitored. Monitoring systems often report on many different events at once, based on anomalies occurring in the monitored system at around the same time, same location, or the like. Some of these events, though reported separately, may actually be caused by or otherwise related to the same real-world events, though such information is not provided by or clear from the event data being reported.
For example, in a water network monitoring system, multiple neighboring sensors may register the same event as simultaneous increases or decreases in flow or other quantities in multiple locations. The correct classification of certain anomalous events depends heavily on their multiple effects, which are likely to be detected separately. For example, a breached unmonitored valve between two District Metered Areas (DMAs) typically manifests itself as a simultaneous flow increase in one and corresponding flow decrease in the other, both of which would be detected and reported as events, though as separate events.
Moreover, for a sufficiently small event, individual component anomalies may be statistically insignificant, if viewed separately, but stand out if correctly considered together. However, this requires examining many “not quite significant” anomalies in order to find within them a few significant sets of related anomalies, each of which sets may be the effects of a single significant event in the real world.
Thus, in current network monitoring systems, especially in those used to monitor water utilities, existing methods do not adequately account for different sources or items of event data corresponding to a single network event, leading to misclassification, reduced detection sensitivity and increased workload for users. In addition, the amount of event data increases as additional sensors are added to a network for greater accuracy, or sampling frequencies are increased for more up to date results, thus exacerbating this problem by increasing the number of duplicate events being detected in the network. Therefore there is a need to improve existing event monitoring and detection systems to identify anomalies or events which are related.